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~ The MAILING DATE of this communication appears on the cover sheet with the correspondence address - 
Period for Reply 



A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) OR THIRTY (30) DAYS, 
WHICHEVER IS LONGER, FROM THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1 .1 36{a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 133). 
Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1.704(b). 

Status 

Responsive to communication(s) filed on 15 May 2006 . 
2a)IEI This action is FINAL. 2b)Q This action is non-final. 

3) ED Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1935 CD. 11, 453 O.G. 213. 

Disposition of Claims 

4) Kl Claim(s) 1-5,9-17,21-29 and 33-37 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) D Claim(s) is/are allowed. 

6) I3 Claim(s) 1-4,9-16,21-28 and 33-37 is/are rejected. 

7) |El Claim(s) 5,17,29 is/are objected to. 

8) D Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) 0 The specification is objected to by the Examiner. 

10) D The drawing(s) filed on is/are: a)ED accepted or b)D objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1 .85(a). 
Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1.121(d). 

1 1) ED The oath or declaration is objected to by the Examiner. Note the attached Office Action or form PTO-152. 

Priority under 35 U.S.C. § 119 

12) ED Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 1 19(a)-(d) or (f). 
a)ED All b)ED Some * c)ED None of: 

1 .□ Certified copies of the priority documents have been received, 

2. ED Certified copies of the priority documents have been received in Application No. . 

3-D Copies of the certified copies of the priority documents have been received in this National Stage 
application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 
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DETAILED ACTION 

Claims 1-5,9-17,21-29, and 33-37 have been considered. 



Allowable Subject Matter 

5 Claims 5,17, and 29 are objected to as being dependent upon a rejected base claim, but would 

be allowable if rewritten in independent form including all of the limitations of the base claim and any 
intervening claims. 



Claim Rejections - 35 (JSC §102 

10 The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for 

the rejections under this section made in this Office action: 
A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published under section 122(b), 
by another filed in the United States before the invention by the applicant for patent or (2) a 
15 patent granted on an application for patent by another filed in the United States before the 

invention by the applicant for patent, except that an international application filed under the treaty 
defined in section 351(a) shall have the effects for purposes of this subsection of an application 
filed in the United States only if the international application designated the United States and 
was published under Article 21(2) of such treaty in the English language. 

20 



Claims 1,3,9-13,15,21-25,27, and 33-37 are rejected under 35 U.S.C. 102(e) as being anticipated 
by Hoene, U.S. Patent Application Publication No. 2002/0199116. 



25 As per claims 1,13, and 25, the applicant describes a computer program product comprising the 

following limitations which are met by Hoene: 

(i) reading logic operable to read an update status field associated with a computer file to be 
scanned by a current malware scanner, said update status field being indicative of an update status of a 
previous malware scanner that has scanned said computer file and associated said update status field 

30 with said computer file ([0034]-[0035]); 
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(ii) comparison logic operable to compare said update status of said previous malware scanner 
with an update status of said current malware scanner ([0034]-[0035]); 

(iii) alert issuing logic operable if said update status of said current malware scanner does not 
match said update status of said previous malware scanner to issue an update status alert indicative of 

5 an out-of-date update status for whichever one of said current malware scanner and said previous 
malware scanner has a most out-of-date update status ([0034]-[0035]); 

(iv) change logging logic operable to log changes to said update status field to create a change 
history in an update status tracking database to enable identification of weaknesses within update status 
management based on the change history ([0025],[0036]); 

10 wherein, if said current malware scanner has a less out-of-date update status than said previous 

malware scanner, then said update status field associated with said computer file is changed to 
correspond to said current malware scanner ([0030], [0035]); 

wherein said update status alert includes one or more of: 

(i) a user alert issued on whichever one of said current malware scanner and said previous 
1 5 scanner has a most out-of-date update status ([0030],[0035]-[0036]); 

(ii) an administrator alert issued to an administrator of whichever one of said current malware 
scanner and said previous malware scanner has a most out-of-date update status ([0030],[0035]-[0036]); 

wherein, if there is no said update status associated with said computer file at a first malware 
scanning, then said update status field is generated and associated with said computer file, and said 
20 update status tracking database is updated ([0030],[0035]-[0036]). 



As per claims 3,15, and 27, the applicant describes the computer program product of claims 1,13, 
and 25, which are met by Hoene, with the following limitations which are also met by Hoene: 

Wherein said update status field is included within an update status file passed together and 
25 associated with said computer file between malware scanners ([0033]-[0035]). 
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As per claims 9,21 , and 33, the applicant describes the computer program product of claims 1,13, 
and 25, which are met by Hoene, with the following limitations which are also met by Hoene: 
Wherein said computer file is an e-mail attachment ([0032]). 

As per claims 10,22, and 34, the applicant describes the computer program product of claims 
1,13, and 25, which are met by Hoene, with the following limitations which are also met by Hoene: 

Wherein said current malware scanner and said previous malware scanner are part of a tiered 
malware scanner ([0015],[0033]-[0035]). 

As per claims 11,23, and 35, the applicant describes the computer program product of claims 
1,13, and 25, which are met by Hoene, with the following limitation which is also met by Hoene: 
Wherein said update status field includes one or more of: 

(i) a malware scanner computer program product identifier; 

(ii) a computer hardware identifier; 

(iii) a scanner engine program identifier; 

(iv) a malware definition data version identifier 
([0034]-[0035]). 

As per claims 12,24, and 36, the applicant describes the computer program product of claims 
1,13, and 25, which are met by Hoene, with the following limitation which is also met by Hoene: 
Wherein the malware scanner server to detect one or more of: 

(i) a computer virus; 

(ii) a Trojan computer program; 

(iii) a worm computer program; 

(iv) a banned computer program; 

(v) banned content within an e-mail 
([0034J-[0035]). 
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As per claim 37, the applicant describes the computer program product of claim 1 , which is met 
by Hoene, with the following limitation which is also met by Hoene: 

Wherein said update status alert triggers an automatic update to said malware scanner in 
5 accordance with one of administrator preferences and user preferences ([0035]). 



Claim Rejections - 35 USC §103 

The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all obviousness 
rejections set forth in this Office action: 

10 (a) A patent may not be obtained though the invention is not identically disclosed or described as 

set forth in section 102 of this title, if the differences between the subject matter sought to be 
patented and the prior art are such that the subject matter as a whole would have been obvious 
at the time the invention was made to a person having ordinary skill in the art to which said 
subject matter pertains. Patentability shall not be negatived by the manner in which the invention 

15 was made. 



Claims 2,4,14,16,26, and 28 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Hoene in view of Waldin, U.S. Patent No. 6,094,731. 

20 

As per claims 2,14, and 26, the applicant describes the computer program product of claims 1,13, 
and 25, which are met by Hoene, with the following limitation which is met by Waldin: 

Wherein said update status field is included as a property field within said computer file (Waldin: 
Col 5, lines 21-27); 

25 Hoene discloses all the limitations of claims 1,13, and 25. However, Hoene does not disclose 

that the update status field is included within said computer file. Waldin discloses this idea. It would have 
been obvious to one of ordinary skill in the art at the time the invention was filed to combine the ideas of 
Waldin with those of Hoene and include the update status field with the computer file because doing so 
allows for a convenient way to keep track of the update status field of a computer file. 



30 
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As per claims 4,16, and 28, the applicant describes the computer program product of claims 3,15, 
and 27, which are met by Hoene, with the following limitation which is also met by Waldin: 

Wherein said update status file and said computer file are combined into a combined file that is 
passed as a single entity between malware scanners (Waldin: Col 5, lines 21-27; Col 6, lines 1-9). 

5 

Response to Arguments 

Applicant's arguments, see Remarks filed 5/15/06, with respect to the 102(e) rejection of claim 1 
under Hoene have been fully considered but they are not persuasive. Applicant presents the following 
arguments: 

10 1) Hoene does not teach logging changes to an update status field to create a change history in a 

tracking database to enable identification of weaknesses (as relating to part iv) 

2) Hoene does not teach that if a current malware scanner has a less out-of-date update status 

than said previous malware scanner, then changing an update status field to correspond to a current 

malware scanner (as relating to part iv) 
1 5 3) Hoene does not teach an alert on whichever of said current malware scanner and said 

previous malware scanner has a most out-of-date update status (as relating to claim 1 lines 21-26) 



Examiner respectfully disagrees with the above arguments. Regarding 1), Applicant contests that 
there is no logging of changes in the tracking database of Hoene. Examiner submits that Hoene teaches 

20 a tracking database in which information (e.g. up-to-date virus scan, disabled virus protection, etc) is 
"tracked cumulatively and used for detecting patterns in virus infection, detection, and eradication" 
[0025]. By cumulatively tracking such information, and thus changes to such information, it is possible to 
detect corresponding patterns. Further, Applicant alleges that there is no identification of weaknesses 
(Remarks: page 2, lines 9-13). However, Applicant provides no explanation as to how the language of 

25 the claim is believed to patentably distinguish over the reference. As such, Applicant's statement fails to 
comply with the provisions of CFR 1.111(b). 
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Examiner further notes that the claim language of contest Was clarified in an interview with John 
Lastova (#33,149), a representative for Applicant, on 7/18/05. Notes from the interview were submitted in 
the record (see action mailed 8/5/05, page 3 lines 20-25). 

Regarding 2), Hoene teaches that a server may receive a virus scan report and an indication of 
5 the date of virus definitions. If the date of virus definitions is less than that of a current malware scanner 
[0034], the client must complete a rescan with updated virus definitions. By successfully completing the 
virus scan and providing the server with the virus scan report and an acceptable date of virus definitions 
(changed update status field), the client may gain access. 

Regarding 3), Hoene teaches that when a previous malware scanner has a most out-of-date 
10 update status, a server may provide a reminder (alert) to update virus definitions for the previous malware 
scanner [0035]. Examiner further notes that Applicant's arguments with respect to 3) lack clarity as to 
what, specifically, Applicant is arguing. Examiner again reminds Applicant of the provisions of CFR 
1.11 1(b) and courteously requires that, in future correspondence, Applicant provide an explanation as to 
how the language of the claims are believed to patentably distinguish over the reference. 

15 

Applicant's arguments with respect to the 102(e) rejection of claim 3 under Hoene have been fully 
considered, but they are not persuasive. Applicant argues that an update status field is not included 
within an update status file passed together and associated with a computer file. Examiner disagrees. 
Hoene teaches that associated update status information (e.g. virus definition date) is passed together 
20 and associated with a computer file between malware scanners. 



Applicant's arguments with respect to the 103(a) rejection of claim 2 under Hoene in view of 
Waldin have been fully considered, but they are not persuasive. Applicant argues that Waldin does not 
teach the limitations of claim 2. Waldin teaches that contents, such as a file, may be included in a 
25 property field within a computer file. Combining the Waldin reference with Hoene allows the update 
status field information of Waldin to be included in a property field within a computer file transmitted 
between scanners. 
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Applicant's arguments with respect to the 103(a) rejection of claims 5,17, and 29 under Hoene in 
view of Waldin have been fully considered and are persuasive. Therefore, the rejection is withdrawn. 



THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time policy as set forth 
in 37CFR 1136(a). 

A shortened statutory period for reply to this final action is set to expire THREE MONTHS from 
the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date 

10 of this final action and the advisory action is not mailed until after the end of the THREE-MONTH 

shortened statutory period, then the shortened statutory period will expire on the date the advisory action 
is mailed, and any extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of 
the advisory action. In no event, however, will the statutory period for reply expire later than SIX 
MONTHS from the mailing date of this final action. 

15 Any inquiry concerning this communication or earlier communications from the examiner should 

be directed to Kevin Schubert whose telephone number is (571) 272-4239. The examiner can normally 
be reached on M-F 7:30-6:00. If attempts to reach the examiner by telephone are unsuccessful, the 
examiner's supervisor, Emmanuel Moise can be reached on (571) 272-3865. The fax phone number for 
the organization where this application or proceeding is assigned is 571-273-8300. Information regarding 

20 the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) 

system. Status information for published applications may be obtained from either Private PAIR or Public 
PAIR. Status information for unpublished applications is available through Private PAIR only. For more 
information about the PAIR system, see http://pair-direct.uspto.gov. Should you have questions on 
access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll- 



5 



Conclusion 



25 free). 



EMMANUEL L MOISE 
SUPERVISORY PATENT EXAMINER 




